                             :value    subject-pub}]]
         (is (= (set exts) (set exts-expected)))))
 
-    (testing "trusted fact extensions are copied from CSR"
+    (testing "trusted fact extensions are properly unfiltered"
       (let [csr-exts [(utils/puppet-node-image-name "imagename" false)
                       (utils/puppet-node-uid "UUUU-IIIII-DDD" false)]
             csr      (utils/generate-certificate-request

        (is (= exts exts-expected))))

    (testing "only puppet extensions are copied from CSR to cert"
      (let [csr-exts [(utils/subject-dns-alt-names ["onefish"] false)]
            csr      (utils/generate-certificate-request
                       subject-keys subject-dn csr-exts)
            exts (create-agent-extensions csr issuer-pub)

                            :value #{:digital-signature :key-encipherment}}
                           {:oid "2.5.29.14"
                            :critical false
                            :value subject-pub}
                           {:critical false
                            :oid      "1.3.6.1.4.1.34380.1.1.1"
                            :value    "AAAA-BBBB-CCCC-DDDD"}]]
        (is (= exts exts-expected))))))
